The invention involves methods for implementing and reporting network measurements between a source of probe packets and an element, such as a router. The invention exploits commonly implemented features on commercial elements. By exploiting these features, the expense of deploying special purpose measurement devices can be avoided.
Network traffic measurement is an essential component of communications network management. Both passive and active measurement methods are currently deployed. In passive measurement methods, ordinary traffic packets are observed at network elements, such as routers, which then compile reports on the packets, either singly or in aggregate. The reports are either stored at the network element for retrieval by the network management system (the pull model, e.g. for SNMP statistics) or dispatched to a collector (the push model, e.g. NetFlow statistics). Passive measurement is most commonly used to determine the amounts of traffic of various types (e.g. as indicated by packet header fields) flowing in the network.
In active measurement, probe packets are introduced into the network (e.g., by a special purpose source measurement device) and dispatched to one or more destination network elements. Active measurement is most commonly used to determine the performance properties of the path between the source and the destination(s), and/or the performance properties of the destination device(s) themselves. Determining these properties is essential for network management purposes including anomaly detection, network health monitoring, SLA conformance monitoring, and root cause analysis.
A large number of active measurement techniques have been developed in order to measure or infer various path performance properties. From the service provider point of view, it is useful to classify each technique according to whether it suffices for the measurement destination to be an ordinary production device (such as an already deployed router) or whether it must be a special purpose measurement device. This is an important distinction because the introduction of an additional measurement device carries equipment, management and administrative costs which can be substantial if many such devices are required to be deployed at the scale of a large network. One role that may be performed by such a special purpose measurement device is to terminate active measurements by receiving the probe packets and to compile and dispatch reports on them. This functionality not routinely provided by ordinary production devices. For this reason, it would be advantageous if such functionality could be effectively performed by ordinary production devices.
Another way in which ordinary and special purpose devices can be distinguished is in the way they treat probe sequence numbers. In several measurement applications one wants to keep track of an application sequence number that could be used to identify the same packet seen at multiple points along its path, or at distinct endpoints in the case of multicast probes. The measurement capabilities supported by ordinary routers do not typically read or report on such sequence numbers, whereas a special purpose device can be configured to do so. Again, it would be advantageous if such functionality could be effectively performed by ordinary production devices.
An example of an active measurement technique is described in U.S. Pat. No. 6,958,977. The '977 patent involves a plurality of capture-capable network agents (CCNAs) that are controlled by a testing center and are coupled to the network at various locations. The CCNAs intercept packets that meet a predetermined filtering criterion that is specified by the testing center, and report to the testing center on the intercepted packets. By collecting reports from multiple CCNAs that intercept a given packet passing through the network from one end-point to another, a testing center is able to analyze details of the route and timing characteristics of the multiple links and nodes within the network.
The CCNAs may comprise software agents associated with an existing piece of network equipment, such as a switch or router, or they may comprise stand-alone probes. The CCNAs are directed by the testing center to perform various functions and pass the results back to the testing center. With these results, the testing center is able to calculate various network parameters.
In the method of the '977 patent, the testing center, which creates the unique packets, must inform the CCNAs about those packets. With that information, the CCNAs then filter out and report on the packets that meet the designated criteria, letting the other network packets continue on their course. If the testing center does not inform the CCNAs about these packets, the CCNAs would not know to filter and analyze the relevant packets from all of the other packets traveling through the network. In such “instructioned” measurements, the network element must be instructed on, for example, which packets to measure and what measurements to make. We refer to such network elements as “instructioned” network elements and to such measurements as “instructioned” measurements.
As opposed to instructioned” measurements, certain measurements are made by the network element without any specific, special instruction being given to the network element, either directly or by the packet to be measured, regarding what specific action is to be taken with regard to this measurement, or the specific packets to be measured. Rather, the measurement is made in the normal course of management by the network element—the specific nature of the report is prompted by the characteristics of the packet and the normal management protocol of the network element, rather than by any special instruction to the network element relating to a specific measurement. We refer to such measurements as “instructionless” measurements, and to such network elements as “instructionless” network elements, because the network elements do not receive any specific instructions, either directly or by the packet to be measured, regarding the specific measurement to be made or the specific packets to be measured
Another classification of network measurement techniques depends on whether they measure properties of the one-way path from the source measurement device to the destinations, or whether they measure round trip properties. Roundtrip properties are typically easier to measure, because they do not require the destination to participate in the collection of probe packets and compilation and dispatch of reports. Rather, they are required only to use their normal capabilities to respond to probe packets by sending a packet, usually back to the probe source, which terminates the measurements. The commonly used ping and trace-route tools fall into this category.
On the other hand, roundtrip measurements are less useful than one-way measurements since it is not possible to distinguish (at least with any certainty) whether the observed performance should be attributed to the outward or return path. For example, when roundtrip loss is observed for a probe packet stream, it is not known what portion of the loss occurs on the outward path and what portion on the return path. The inherent ambiguities of interpreting round-trip measurements make one-way measurement more attractive for understanding network properties, while at the same time they are more challenging to implement because ordinary network elements cannot terminate arbitrary probe packet streams.
Accordingly, it would be advantageous to have more efficient network measurement techniques which do not require specialized network equipment other than a probe source and which could be used to make one-way network measurements.